weird cookie behavior

[valerian <va...@bellsouth.net>]

I'm experiencing strange behavior with cookies when my scripts are
accessed in mod_perl (using Apache::Registry).  Everything works fine so
long as my browser is configured to not go through a proxy (ie, in
Netscape 4.77, "directly connected to the Internet" option is selected).
When I configure it to use a custom proxy (eg, Junkbuster running on my
LAN gateway), my cookies no longer work, but I can still browse the web
fine.

I should point out that everything works ok when the scripts are
accessed as CGI's rather than mod_perl.  Hence I'm fairly certain the
problem is not with the Junkbuster proxy, but has something to do with
mod_perl.

These are the software versions:

    Debian/Linux 3.0
    Apache 1.3.26 + mod_ssl 2.8.9 (running in proxy accelerator mode)
    Apache 1.3.26 + mod_perl 1.26
    Perl 5.6.1

I'm using CGI.pm to create the cookie headers.  Typical code looks like this:

    # Setting a cookie
    # (the test.pl script will retrieve the cookie and check auth_info)
    $cookie = MI_BakeCookie($q, $form->{'email'}, $form->{'passwd'});
    print $q->redirect(-cookie=>$cookie, -url=>"/perl/test.pl?op=menu");
    
    # Retrieving a cookie
    $cookie = $q->cookie('auth_info');
    @form{'email', 'crypt'} = split (':', $cookie);
    
    # The function that creates the cookies...
    # Creates a temporary auth_info cookie which contains the user's
    # email address and encrypted password (MD5 hash).
    sub MI_BakeCookie {
            my ($q, $email, $password) = @_;
    
            my $crypt = md5_hex($password);
            my $auth_info = join (':', $email, $crypt);
    
            my $cookie = $q->cookie(-name=>'auth_info',
                    -value=>$auth_info,
                    # -expires=>'+10d',
                    -path=>'/',
                    -secure=>0   # haven't changed this yet...
            );
    
            return ($cookie);
    }

It's all pretty straightforward stuff...  which is why I'm confused and
hope that someone might have an idea as to what's going on here.  I'm
open to any suggestions, but alas I don't have a lot of time to spare so
can't really afford to make my own custom handler and switch to
Apache::Cookie or whatnot.  But if that's the only solution, then I
gotta do what I gotta do.

Anyway, please let me know if you have any ideas. :)

Re: weird cookie behavior

[Josh Chamas <jo...@chamas.com>]

valerian wrote:
> I'm experiencing strange behavior with cookies when my scripts are
> accessed in mod_perl (using Apache::Registry).  Everything works fine so
> long as my browser is configured to not go through a proxy (ie, in
> Netscape 4.77, "directly connected to the Internet" option is selected).
> When I configure it to use a custom proxy (eg, Junkbuster running on my
> LAN gateway), my cookies no longer work, but I can still browse the web
> fine.
> 

I would not rule out the junkbuster proxy just yet.

To get at the root of the problem, you will need to see the HTTP
headers as they are output directly from your program, with and
without the proxy.  You can use lwp-request for this like:

   lwp-request -ed http://URL/PATH

   lwp-request -ed -p PROXY http://URL/PATH

and see what HTTP headers come back.

If the headers change, then maybe the junkbuster proxy
is munging something up or dropping headers.  It may be
that there is some header special to mod_perl that is messing
up junkbuster for example so that you do not see the problem
in CGI mode.

There is also a chance that junkbuster is adding some
header, only for the mod_perl output that simply messes
up netscape.  Either way, seeing the headers themselves
should help get to the root of it.  If its the former
scenario, I would take the problem first to the junkbuster
developers.

Regards,

Josh
________________________________________________________________
Josh Chamas, Founder                   phone:925-552-0128
Chamas Enterprises Inc.                http://www.chamas.com
NodeWorks Link Checking                http://www.nodeworks.com